A developer is debugging an application that uses Amazon DynamoDB (us-west-2). The app runs on an Amazon EC2 instance and needs read-only access to a table named Cars. The EC2 instance has an IAM role with a policy attached, but when the app attempts to read the Cars table it gets Access Denied. How should the developer fix this issue?

The correct answer is to create a trust policy that lists the EC2 service principal and attach it to the role. An IAM role needs a trust policy to define which entities (like an EC2 instance) are allowed to assume that role. Without a trust policy allowing the EC2 service to assume the role, the application running on the EC2 instance cannot use the permissions defined in the role's attached policy, resulting in an "Access Denied" error. Changing the IAM policy's Resource to "arn:aws:dynamodb:us-west-2:account-id:table/" would broaden the resource scope but wouldn't resolve the fundamental issue of the EC2 instance not being able to assume the role in the first place. Updating the IAM policy to include the dynamodb: action would grant broader permissions, but again, the EC2 instance still couldn't assume the role. Creating a trust relationship with dynamodb.amazonaws.com is incorrect because DynamoDB is the resource being accessed, not the service that needs to assume the role; the EC2 service needs to assume the role.